Context: The Expert Witness in Cyberspace

A witness, in common usage, is someone who saw an event take place. The term is generally used for dramatic or significant events. For example, most people would say they witnessed a car wreck but not say they witnessed a car parking. In the legal community, we subscribe to neither convention. To us, witnesses are people who speak about an event whether or not they saw it; whether the event is large or small. The question, "Were there any witnesses?" inquires about potential testimony, not about first-hand experience. Even by this standard, an expert witness is a strange beast. He is expected to do something that other witnesses are not allowed to do: express opinions.

What Makes a Good Expert Witness?
Reducing a term of art into individual words rarely aides in understanding. In this case, however, it provides an exact definition. An expert witness needs to be an expert in a field and also be a good witness. Unfortunately the two are usually mutually exclusive. This is doubly so in the realm of computers and the Internet. When was the last time you talked with a computer expert and completely understood him? The nerdy inhabitants of cyberspace are notoriously bad at communicating. Indeed, many of them got into the profession because of their difficulty relating to other humans.

As an expert, a witness needs to not only be competent, he needs to look competent both in person and on paper. Part of looking good lies in his skills as a witness, but even before he is deposed, his resume and report can change the opposition's strategy. Experience and credentials will be the best indicators.

Experience is relative. While it is easy to find a forty year veteran of the construction industry, it is impossible to find a webmaster with over a decade of experience. The World Wide Web, as we know it, has not been around that long. Similarly, 30 years of programming work sounds impressive, but if the expert is not familiar with current operating systems he is easy to impeach.

Credentials are easy to quantify in terms of education, publication and business success. Be as wary of outdated credentials as you are of ancient experience. It is a good idea to run a background check on your expert before your opposition does. Hiring from a reputable agency should eliminate the need for this since they check for resume puffery prior to representing the expert.

As a witness, our expert needs to be well spoken, well written and engaging. He should neither pontificate nor dither. He needs to establish his opinions with solid logic and hold them strongly, but not blindly. An expert that refuses to consider (and eventually refute) alternate opinions is no more credible than one who will change his mind with every new piece of evidence.

If you expect testimony to be important, interview the expert in person. Most will not object to a little role playing as long as they are forewarned. Deposition and trial testimony are different. Ask him if he understands this difference and have him answer sample questions both ways. While nothing substitutes for experience in actual testimony, witnesses that speak in public and field questions as part of their talk are more likely to hold up under pressure. This includes teachers and professional speakers as well as those on the luncheon circuit.

In the end, the best judge of your expert's qualifications will be another computer consultant. The best judge of his abilities as a witness will be you.

How to Use Your Expert Witness
Data without context is noise. On the way to stating his opinions, the expert witness needs to provide an environment for understanding. He provides the context that allows a judge and jury to understand the data. The first article in this series discussed the acquisition and documentation of data. While most computer expert witnesses are also computer forensic investigators, many times the expert subs-out the investigation. The expert witness's ability to provide a context is as important as the validity of his opinions.

When testifying about computers, an expert will spend most of his time "translating", i.e. making sure that the audience understands technical terms and their usage. All cases require an expert witnesses to write a report. Fewer are deposed. Testimony at trial is relatively rare. With this in mind, select your expert as much on his writing abilities as his speaking presence. Ask for examples of his reports and other writings.

Testimony about the Internet tends to be more story telling than translating. Events that transpire in cyberspace have their own time frames and mores. For example, unless the judge and jury spend their evenings in chat rooms or on instant messaging, they will not know that a transcript of such things will take fifteen minutes to read but would have taken three hours to type. Many Internet-related cases involve distasteful or aberrant aspects of life. An expert need to discuss such things directly and professionally.

A good lawyer will make sure that an expert witness's direct testimony flows naturally by having it be more of a conversation than an interrogation. Open ended questions allow the witness to engage the jury and help "humanize" him in their eyes. Good examples are "How did you discover that fact?", "Why do you hold that opinion?" and the all time best, "Please, tell me more."

Remind your expert that he earns his money during cross-examination. The opposing lawyer will either try to use a similar strategy against your case or try to get your witness flustered. While the witness needs to still be engaging, he should keep his answers short and provide minimal explanation and then only when asked.

 

Edward Pscheidt
Computer Forensics
24881 Alicia Parkway, #E-325
Laguna Hills, CA 92653
(949) 829-5700
edward@suremail.com